Remove hard dependency on mcrypt

From #5440 a few key distros (redhat) will be dropping mcrypt support. We can and should switch to openssl earlier. openssl is more widely maintained and easier to use.

I've left the default to be mcrypt mostly out of backwards compatibility issues. Because our earlier implementation of `encrypt()` did not use PKCS#7 the data encrypted by it cannot be decrypted with openssl. For people with both extensions, it would be best if their code didn't break.
Shouldn't availability of openssl be checked first as the point of the change is to avoid mcrypt usage?  Those upgrading their app and requiring mcrypt can set is explicitly in bootstrap by doing `Security::engine(new Mcrypt());` isn't it?